20. A method for policy-based billing for a distributed network session, comprising: 

(a) receiving a plurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 

(c) analyzing the plurality of packets to identify a plurality of flows; 

(d) identifying a session associated with the flows; 

(e) identifying at least one application associated with the session; 

(f) reconstructing the session utilizing the identified application at a plurality of 
collaborating nodes; 

(g) identifying a user associated with the session; 

(h) determining a policy; and 

(i) billing the user for the session in accordance with the policy. 

21. The method as recited in claim 20, and further comprising filtering the packets for 
removing packets unrelated to the session. 

22. The method as recited in claim 20, and further comprising identifying application 
events associated with the session based on the policy. 

23. The method as recited in claim 22, and further comprising assigning a 
significance to the application events based on the policy. 

24. The method as recited in claim 22, wherein the user is billed for the session 
utilizing the application events in accordance with the policy. 

25. The method as recited in claim 22, and further comprising determining billing 
information for the session using the application events in accordance with the policy. 

26. The method as recited in claim 25, and further comprising outputting a report 
including the billing information in accordance with the policy. 
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27. The method as recited in claim 20, and further comprising restricting tasks of the 
user in accordance with the poHcy. 

28. The method as recited in claim 27, wherein an amount of bandwidth is restricted 
in accordance with the policy. 

29. The method as recited in claim 20, wherein the policy includes a series of packet 
capture language expressions and output selectors. 

30. A computer program product for policy-based billing for a distributed network 
session, comprising: 

(a) computer code for receiving a plurality of packets at a plurality of analyzers; 

(b) computer code for aggregating the plurality of packets; 

(c) computer code for analyzing the plurality of packets to identify a plurality of 
flows; 

(d) computer code for identifying a session associated with the flows; 

(e) computer code for identifying at least one application associated with the session; 

(f) computer code for reconstructing the session utilizing the identified application at 
a plurality of collaborating nodes; 

(g) computer code for identifying a user associated with the session; 

(h) computer code for determining a policy; and 

(i) computer code for billing the user for the session in accordance with the policy, 

31. The computer program product as recited in claim 30, and further comprising 
computer code for filtering the packets for removing packets unrelated to the session. 

32. The computer program product as recited in claim 30, and further comprising 
computer code for identifying application events associated with the session based on the 
policy. 
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33. The computer program product as recited in claim 32, and further comprising 
computer code for assigning a significance to the application events based on the policy. 

34. The computer program product as recited in claim 32, wherein the user is billed 
for the session utilizing the application events in accordance with the policy. 

35. The computer program product as recited in claim 32, and further comprising 
computer code for determining billing information for the session using the application 
events in accordance with the policy. 

36. The computer program product as recited in claim 35, and further comprising 
computer code for outputting a report including the billing information in accordance 
with the policy. 

37. The computer program product as recited in claim 30, and further comprising 
computer code for restricting tasks of the user in accordance with the policy. 

38. The computer program product as recited in claim 37, wherein an amount of 
bandwidth is restricted in accordance with the policy. 

39. The computer program product as recited in claim 30, wherein the policy includes 
a series of packet capture language expressions and output selectors. 

40. A method for policy-based billing for a distributed network session, comprising: 

(a) receiving a plurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 

(c) analyzing the plurality of packets to identify at least a first flow; 

(d) identifying a session associated with the first flow; 

(e) identifying additional flows in the plurality of packets associated with the session; 

(f) filtering the packets for removing packets unrelated to the session; 

(g) identifying at least one application associated with the session; 
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(h) reconstructing the session utilizing the identified application at a plurality of 
collaborating nodes; 

(i) identifying a user associated with the session; 
(j) identifying a policy; 

(k) gathering application events associated with the session based on the policy; 

(1) assigning a significance to the application events based on the policy; 

(m) determining billing information for the session using the application events in 




accordance with the policy; 
(n) outputting a report including the billing information in accordance with the 



policy; 

(o) restricting tasks of the user in accordance with the policy; and 
(p) executing actions in response to the application events in accordance with the 
policy. 

41. The method as recited in claim 20, wherein a first flow associated with a first 
application flows through a first one of the nodes. 

42. The method as recited in claim 41, wherein a second flow associated with the first 
application flows through a second one of the nodes. 

43. The method as recited in claim 20, wherein each of the collaborating nodes 
includes a packet source and a first hierarchical network analyzer. 

44. The method as recited in claim 43, wherein each of the collaborating nodes further 
includes a filter coupled between the packet source and the first hierarchical network 
analyzer. 

45. The method as recited in claim 43, wherein the first hierarchical network 
analyzers of each of the nodes feed information to a second hierarchical network 
analyzer. 
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46. The method as recited in claim 45, wherein the information is used by the second 
hierarchical network analyzer to reconstruct the session utilizing the identified 
application. 

47. The method as recited in claim 45, wherein the information involves packet 
forwarding. 

48. The method as recited in claim 45, wherein the information involves hints and 
packet forwarding. 

49. The method as recited in claim 45, wherein the information involves hints and a 
summary of packets. 

50. The method as recited in claim 20, wherein the nodes each include a router. 
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